PT-2026-34421 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-05-26 · CVE-2026-31516

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the xfrm component where a 'XFRM MSG NEWSPDINFO' request can queue the policy hthresh.work work item onto the system workqueue. The callback function xfrm hash rebuild() retrieves the struct net using container of(). If the network namespace is torn down before the work item executes, xfrm hash rebuild() may dereference memory that has already been freed because xfrm policy fini() failed to synchronize policy hthresh.work during the teardown process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-31516

ECHO-4784-429C-F2D8

Affected Products

Linux Kernel

References · 16

• https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e · Patch
• https://cve.org/CVERecord?id=CVE-2026-31516 · Security Note
• https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31516 · Vendor Advisory
• https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8 · Patch
• https://git.kernel.org/stable/c/4e2e77843fef473ef47e322d52436d8308582a96 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31516 · Security Note
• https://ubuntu.com/security/CVE-2026-31516 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31516 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31516 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31516 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31516 · Vendor Advisory
• https://docs.bell-sw.com/security/cves/CVE-2026-31516 · Note
• https://twitter.com/VulmonFeeds/status/2047050583454912522 · Twitter Post
• https://git.kernel.org/linus/29fe3a61bcdce398ee3955101c39f89c01a8a77e · Note